CVE-2026-80255

CVE-2026-80255 is a cookie-parsing flaw in curl and libcurl: when a server's Set-Cookie header places a horizontal tab (ASCII 9) instead of a space immediately before the 'Secure' attribute, curl stores the cookie without its Secure flag. The flaw is triggered whenever a server emits such a malformed header and the client uses curl's cookie engine on subsequent requests. As a result, a cookie meant to be restricted to HTTPS may be wrongfully sent over plaintext HTTP, letting a network attacker who can force or observe HTTP traffic capture sensitive cookies such as session tokens (high confidentiality impact, per CWE-201). Anyone using curl or an application, service, or firmware embedding libcurl — from CLI tools to embedded devices — is potentially affected, since the vulnerable code is in the widely distributed cookie engine. Exploitation status: no public proof-of-concept, not listed in CISA KEV, and EPSS estimates only a 0.5% chance of exploitation within 30 days.

What to do: Upgrade curl and any bundled/embedded libcurl to the patched release identified in the curl project advisory for CVE-2026-80255 (no fixed version number is given in the provided data). Audit dependencies and firmware builds for embedded libcurl, and as a mitigation avoid cookie reuse across HTTP and HTTPS to the same host and prefer HTTPS-only requests. With no public PoC or known in-the-wild exploitation, this can be handled in routine patch cycles, but prioritize hosts where captured cookies would grant significant access.